Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

saml attribute - multiple value separate per string

ruancarloss
Nimbostratus
Nimbostratus

I have the following need in the "Saml attribute" settings of the SAML IDP server, I need a variable to assign in the apm, filtering all groups that contain the XYZ text, and each value being delivered as a separate string follows below as needed, and how the f5 delivers.

3 REPLIES 3

Hi @ruancarloss,

you would use a Variable Assign in the Visiual Policy Editor and use a custom expression to filter for AD Groups with the string XYZ. 

Here is very simple example, starting with the Access Policy.

Daniel_Wolf_0-1668167454766.pngAnd here is the Variable Assign (in my example I filter for all AD Groups with the string test and store them in the custom variable session.custom.mygroups.

Daniel_Wolf_1-1668167558678.png

 

set list "|";
foreach element [split [mcget {session.ad.last.attr.memberOf}] "|"] {
    if { $element contains "test"} {
        append list "$element|";
    }
}
return $list;

 

The IdP configuration then uses my custom variable session.custom.mygroups for the SAML attribute MyGroups.

Daniel_Wolf_2-1668167713089.png

The resulting SAML token has the following attributes:

Daniel_Wolf_3-1668167857922.png

 

Does this answer your question?

KR
Daniel

ruancarloss
Nimbostratus
Nimbostratus

the loop created works and thank you.
However I need only the CN value to be delivered.
enjoying your scenery, the script delivers:
* CN=testgruppe1,OU=grou.....
* CN=testgruppe2,OU=grou.....

would have to customize for the output to be:
* testgroupp1
* testgrouppe2

Thank you for your help

The example below I had more or less ready for copy&paste.
I think you could use the trim command to customize the output to your desired format.

Take a look here